CVE-2019-12719

Vulnerability

An incorrect access control vulnerability exists in the Picture_Manage_mvc.aspx page of the AUO SunVeillance Monitoring System prior to version v1.1.9e [1]. The page exposes two parameters, Act and authority. While a guest user is normally restricted from uploading pictures, the authority parameter is not properly validated on the server [1]. By changing the default guest authority value of 40 to 100, the upload button becomes enabled without any authentication [1]. This allows any unauthenticated user to reach the file upload code path [1].

Exploitation

An attacker needs only network access to the web interface [1]. No authentication, session token, or special user role is required [1]. The steps are: (1) navigate to /Solar_Web_Portal/Picture_Manage_mvc.aspx without logging in; (2) modify the authority POST/GET parameter from 40 to 100; (3) the upload form becomes functional and the attacker can submit a file [1]. The file is stored server-side [1].

Impact

A successful attacker can upload arbitrary files to the server [1]. The impact depends on the server's file storage location and subsequent processing—if uploaded files are accessible or executed, the attacker could achieve remote code execution, information disclosure, or defacement [1]. At a minimum, the integrity of the system is compromised [1].

Mitigation

AUO released version v1.1.9e to fix the issue [1]. All installations running earlier versions should be updated to v1.1.9e or later [1]. There are no known workarounds; the vulnerable authority parameter logic must be corrected by the vendor patch [1].